Many of our post-quantum courses are built on the PQC Migration Framework. We link each download to the PDF on the framework’s own website. We will be adding other frameworks as we review them and adopt them into our curriculum.
PQC Migration Framework
Version 3.0 · September 2026 · Marin Ivezic · CC BY 4.0
The Applied Quantum PQC Migration Framework is an open methodology for planning and running an enterprise-wide post-quantum migration. Marin first drafted it in 2023 and tested it in real migration programs before publishing it in full in June 2025.
It defines eight phases, from the executive mandate through discovery, the cryptographic bill of materials (CBOM), risk scoring, the roadmap, pilots, infrastructure, and vendor governance. Five program foundations apply across all eight phases – the maturity model, metrics and KPIs, crypto-agility, regulatory mapping, and skills and teams.
In version 3.0, an organization completes the program when it can make a second algorithm change on a date it chooses.
Sector extensions
Use each sector extension with the Universal edition. Each one adds the challenges and phase adaptations for its sector.
Our sector courses are built on these extensions, among them Quantum-Safe Financial Services, Payments, Digital Assets, Telecommunications, OT and Critical Infrastructure, and Government and Defense.
Cryptographic Concentration Framework
Version 1.0-RC · August 2026 · Marin Ivezic and Steve Vaile · CC BY 4.0
The Applied Quantum Cryptographic Concentration Framework (CCF) is a method for second-line risk teams to measure cryptographic concentration beneath the vendor layer. An institution can run four HSM vendors, three TLS terminators, and two certificate providers and still depend on one shared code lineage, trust anchor, or key-generation design.
Assessors apply CCF to each important business service at six layers, from the algorithm to key generation. For each service they report two figures, the Cryptographic Concentration Index and failure-domain reach. Where a supplier does not disclose its lineage, the assessor records reach as a bound.
Applied Quantum plans to publish version 1.0 in November 2026.
Supporting documents
The sector extensions cover payments and financial services, and the white paper covers cryptographic concentration in payments. The CBOM Conformance Statement lists the CBOM Profile fields that each CCF level requires, and the Technical Companion covers how to obtain the data.
Assessment instruments
Applied Quantum has published five of the framework’s six instruments, from the first data request to the board report template. The sixth, the Discovery Coverage Attestation, follows in version 1.1.
CBOM Profile
Version 1.0-RC · August 2026 · Marin Ivezic and Steve Vaile · CC BY 4.0
The Applied Quantum CBOM Profile is a property taxonomy that extends CycloneDX (ECMA-424) for cryptographic bills of materials. Its 50 properties, in eight subnamespaces, cover post-quantum migration governance, financial-sector and custody context, and the inputs that CCF requires.
The profile has four tiers. A migration team adopts tiers 1 to 3, and a team measuring concentration adds tier 4.
Applied Quantum is taking comments on the release candidate until October 31, 2026, and plans a second release candidate for Q4 2026.
Courses on the migration framework
We teach the framework’s phases in the Post-Quantum Foundation, PQCM training, and PQC Migration Project Management. For hands-on inventory work, see Cryptographic Discovery, Inventory, and CBOM.
Quantum Ready, Marin’s book on post-quantum migration, is built on the framework. To train your team for the migration itself, browse our courses and certifications.